William Metcalf

I have been recruited by the Star League to defend the Frontier against Xur and the Ko-dan Armada

[William Metcalf @node5]

@SquiblydooBlog I was also recently looking into this for keys pulled out of lsass/SSLKEYLOG for cape runs. I found a PAN writeup from years ago that claimed this was possible with tshark but couldn’t get to work so I recently baked it into my HAR/SaZ conversion tool https://t.co/oVFaaBatjn

[The Haag™ @M_haggis]

Security Detections MCP 3.0 is LIVE

What started as a detection search MCP is now an autonomous detection engineering pipeline.

Agents now run a full workflow:

CTI → coverage analysis → detection generation → SIEM validation → PR staging

Pipeline example:

• CTI Analyst → extracts MITRE techniques from threat intel
• Coverage Analyzer → checks 7k+ detections across Sigma / Splunk / KQL / Elastic
• Detection Engineer → generates missing detections
• Atomic Executor + SIEM Validator → tests detections
• PR Stager → prepares them for review

Multi-SIEM support:
Splunk • Sentinel • Elastic • Sigma

Open source 👇
Repo
https://t.co/hF5mrvTJkT

npm
https://t.co/ai3fqSmnri

Pulse MCP listing
https://t.co/gEy3m5aUP1

Watch the full demo:
https://t.co/xIIk9mhYmw

[grsecurity @grsecurity]

https://t.co/9qhx1SrRiU

[Splunk @splunk]

Talk about ending the week on a high note. 🎉 With @Cisco's acquisition of @snapattackHQ now complete, we're looking forward to driving further Splunk innovation as we continue to deliver security solutions that support today's new era of SIEM. Read more here. #SplunkSecurity

[William Metcalf @node5]

Enjoy punching phish? Experience writing detections for phish, using regex, Yara, etc., and looking to grow as a researcher within an experienced team? Join me and the rest of the Splunk Attack Analyzer Misfits of Detection Science. US only, fully remote https://t.co/Crr9enas1y

[William Metcalf @node5]

@kk_onstantin No doubt! But more signal never hurts :)

[William Metcalf @node5]

For the 2 people who probably care I took a stab at adding cert validation, SAN extraction, and missing/invalid certs. https://t.co/DTCblEsK7U

[William Metcalf @node5]

I'll just leave this here... https://t.co/DTCblEsK7U

[Oasis @oasis]

“America.
Oasis is coming.
You have one last chance to prove that you loved us all along.”
Oasis will tour North America in 2025!
Register for the North American ticket pre-sale private ballot 👉https://t.co/KI12bcTr4l
The pre-sale will take place Thursday, 3rd October.
Tickets go on general sale this Friday, 4th October at midday local venue time.
@CageTheElephant

[Oasis @oasis]

“This is it, this is happening”
Tickets on sale this Saturday 31st August (🇮🇪8AM IST / 🇬🇧9AM BST)
Dates:
Cardiff Principality Stadium - 4th/5th July
Manchester Heaton Park - 11th/12th/19th/20th July
London Wembley Stadium - 25th/26th July & 2nd/3rd August
Edinburgh Scottish Gas Murrayfield Stadium - 8th/9th August
Dublin Croke Park - 16th/17th August

[SQUASH B’GOSH @otherjrobbins]

“Oi bruv me gonna nab some Oasis tickets innit”

[Variety @Variety]

Liam and Noel Gallagher seemingly confirmed that an Oasis reunion is happening after sharing a cryptic clip on social media on Sunday.
https://t.co/qMWVdUAiZp

[William Metcalf @node5]

@HackingDave

[Josh Stroschein | The Cyber Yeti @jstrosch]

I've hosted several malware analysis workshops over the past few years, I've collected those on YouTube and added to the following playlist 👇

https://t.co/4AnrFK8fLB

Samples from the workshops have been archived on Github:

👉 https://t.co/gsiU3hyrlj

[The Haag™ @M_haggis]

Moar soon! Big updates coming

[William Metcalf @node5]

@rvrsh3ll @HackingDave https://t.co/hT84e5QHoH

[William Metcalf @node5]

@elasticseclabs @dez_ @SBousseaden Nice write-up. @a_de_pasquale and I cooked up this little tool for analyzing MSC's. Might be useful to you and others? https://t.co/IvauR2JbvV

[Br3akp0int @tccontre18]

Happy to share this #STRT blog focusing on how attacker weaponized .LNK files in several phishing campaigns. In this blog we analyzed several malicious LNK to extract TTP’s for #detections and #simulation dev. enjoy reading!

#int3 #splunk #cisco

https://t.co/ju5IlQwIpS

[William Metcalf @node5]

I'll just leave this here... https://t.co/IvauR2JbvV